# ---------------------------------------------------------------------------
# (c) DP.dev 2019
#
# MojaveCheck
# Mojave settings for a sane level of privacy / security.
# ---------------------------------------------------------------------------

#!/usr/bin/env zsh

# ---------------------------------------------------------------------------
# Create the log directory and log file on run.
# ---------------------------------------------------------------------------

mkdir -p /tmp/harden
chmod 777 /tmp/harden/log.txt
date +"[%Y-%m-%d %H:%M:%S]" >> /tmp/harden/log.txt
printf "\n" >> /tmp/harden/log.txt

# ---------------------------------------------------------------------------
# Requires root / sudo.
# ---------------------------------------------------------------------------

case $(id -Gn) in
    *admin* | root) :;;
    *)              printf "[-] Must be ADMIN or ROOT!" | tee -a /tmp/harden/log.txt
                    exit;;
esac

# ---------------------------------------------------------------------------
# Check Gatekeeper status.
# ---------------------------------------------------------------------------

if [[ "$(spctl --status)" !=  "assessments enabled" ]]
then
    sudo spctl --master-enable
else
    printf "[GATEKEEPER] Already Enabled\n" | tee -a /tmp/harden/log.txt
fi

# ---------------------------------------------------------------------------
# Enforce auto-updates.
# ---------------------------------------------------------------------------

if [[ "$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates 2>/dev/null)" != "1" ]]
then
    sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -int 1
else   
    printf "[Auto-Updates] Already Enabled\n" | tee -a /tmp/harden/log.txt
fi

# ---------------------------------------------------------------------------
# Disable remote events.
# ---------------------------------------------------------------------------

if [[ "$(sudo systemsetup -getremoteappleevents)" != "Remote Apple Events: Off" ]]
then
    sudo systemsetup -setremoteappleevents off
else
    echo "[REMOTE APPLE EVENTS] Already off\n" | tee -a /tmp/harden/log.txt
fi

# ---------------------------------------------------------------------------
# Disable creation of metadata files.
# ---------------------------------------------------------------------------

sudo defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true
sudo defaults write com.apple.desktopservices DSDontWriteUSBStores -bool true

# ---------------------------------------------------------------------------
# Disable iCloud Saves.
# ---------------------------------------------------------------------------

sudo defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool false

# ---------------------------------------------------------------------------
# Disconnect Camera / Webcam Extensions / Frameworks.
# ---------------------------------------------------------------------------

sudo kextunload /System/Library/Extensions/AppleCameraInterface.kext 2>/dev/null
sudo chmod a-r /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC 2>/dev/null
sudo chmod a-r /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/AVC.plugin/Contents/MacOS/AVC 2>/dev/null
sudo chmod a-r /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component/Contents/MacOS/QuickTimeUSBVDCDigitizer 2>/dev/null
sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera 2>/dev/null
sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/FCP-DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera 2>/dev/null